Is CVE-2026-95838 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-95838 being exploited in the wild.

How severe is CVE-2026-95838?

Medium severity, with a CVSS score of 4, published 12 October 2026.

Which products and versions are affected?

Containerd before 1.7.35, 2.0.12, 2.2.8, 2.3.5; github.com/containerd/containerd (Go) < 1.7.35, SEMVER:introduced=0,fixed=1.7.35; github.com/containerd/containerd/v2 (Go) < 2.0.12, SEMVER:introduced=0,fixed=2.0.12, SEMVER:introduced=0,fixed=2.0.12,introduced=2.2.0,fixed=2.2.8,introduced=2.3.0,fixed=2.3.5.

How is CVE-2026-95838 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-95838?

Check whether you run Containerd, github.com/containerd/containerd (Go) or github.com/containerd/containerd/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-95838: containerd layer unpack denial of service via opaque whiteouts

Q: Is there a fix for CVE-2026-95838?

Yes. github.com/containerd/containerd (Go): upgrade to 1.7.35 or later; github.com/containerd/containerd/v2 (Go): upgrade to 2.0.12, 2.3.5 or later. Until then: There are no known workarounds. Users should only pull and import trusted images from known registries until patching is applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-95838 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-95838?

Check whether you run Containerd, github.com/containerd/containerd (Go) or github.com/containerd/containerd/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-95838 · Severity: medium · CVSS 4 · Published 2026-10-12

containerd is a container runtime that pulls and unpacks container images. A maliciously crafted image with specific file configurations can cause the unpack operation to take excessive time and CPU, delaying container startup and potentially blocking other image pulls in systems like Kubernetes that enforce concurrency limits.

Technologies: Containerd, github.com/containerd/containerd (Go), github.com/containerd/containerd/v2 (Go). Vendors: Containerd, Go.

Quick answers

Is CVE-2026-95838 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-95838 being exploited in the wild.
How severe is CVE-2026-95838?: Medium severity, with a CVSS score of 4, published 12 October 2026.
Which products and versions are affected?: Containerd before 1.7.35, 2.0.12, 2.2.8, 2.3.5; github.com/containerd/containerd (Go) < 1.7.35, SEMVER:introduced=0,fixed=1.7.35; github.com/containerd/containerd/v2 (Go) < 2.0.12, SEMVER:introduced=0,fixed=2.0.12, SEMVER:introduced=0,fixed=2.0.12,introduced=2.2.0,fixed=2.2.8,introduced=2.3.0,fixed=2.3.5.
Is there a fix for CVE-2026-95838?: Yes. github.com/containerd/containerd (Go): upgrade to 1.7.35 or later; github.com/containerd/containerd/v2 (Go): upgrade to 2.0.12, 2.3.5 or later. Until then: There are no known workarounds. Users should only pull and import trusted images from known registries until patching is applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-95838 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-95838?: Check whether you run Containerd, github.com/containerd/containerd (Go) or github.com/containerd/containerd/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/containerd/containerd (Go): upgrade to 1.7.35 or later
```
go get github.com/containerd/containerd@v1.7.35
```
github.com/containerd/containerd/v2 (Go): upgrade to 2.0.12, 2.3.5 or later
```
go get github.com/containerd/containerd/v2@v2.3.5
```

There are no known workarounds. Users should only pull and import trusted images from known registries until patching is applied.

Technical details

The vulnerability exists in containerd's layer unpack handler, which exhibits superlinear time complexity when processing certain image layers containing specific file configurations (opaque whiteouts). This causes repeated directory traversals during unpacking. An attacker can craft a malicious image that, when pulled or imported, triggers this condition and degrades system performance without requiring authentication or network access beyond image pull.

Affected products

containerd containerd before 1.7.35, 2.0.12, 2.2.8, 2.3.5

Identifiers

CVE-2026-95838
GHSA-rp3h-jf77-q9p4
GO-2026-6796

Timeline

2026-10-15: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.